I can accept failure, everyone fails at something - But I can't accept not trying.
--
You HAVE to assume your visitor is a maniac serial killer, out to destroy your application. And you have to prevent it.